EvilZone

Programming and Scripting => Projects and Discussion => : gh0st August 03, 2011, 03:52:19 AM

: evil AV (on development)
: gh0st August 03, 2011, 03:52:19 AM
Evil AV     
(http://img812.imageshack.us/img812/2671/50555155106294504488855.jpg) (http://imageshack.us/photo/my-images/812/50555155106294504488855.jpg/)
Evil AV is an antivirus coded on java and its in developing by evilzoners itself this is a very basic software and its features will be added in a future but the basic search engine is being developed any evilzone`s member can add pieces of source codes that will be complement of the modules.

 current source code:

http://pastebin.com/nGnTffbd (http://pastebin.com/nGnTffbd)
 
:
import java.awt.BorderLayout;


public class av extends JFrame {

private JPanel contentPane;
private JButton btnNewButton;

/**
* Launch the application.
*/
public static void main(String[] args) {
EventQueue.invokeLater(new Runnable() {
public void run() {
try {
av frame = new av();
frame.setVisible(true);
} catch (Exception e) {
e.printStackTrace();
}
}
});
}

/**
* Create the frame.
*/
public av() {
setTitle("Evil AV");
setDefaultCloseOperation(JFrame.EXIT_ON_CLOSE);
setBounds(100, 100, 450, 300);
contentPane = new JPanel();
contentPane.setForeground(Color.WHITE);
contentPane.setBorder(new EmptyBorder(5, 5, 5, 5));
setContentPane(contentPane);

btnNewButton = new JButton("Full scan");

JButton button = new JButton("Scan file");
button.addActionListener(new ActionListener() {
public void actionPerformed(ActionEvent arg0) {
}
});
GroupLayout gl_contentPane = new GroupLayout(contentPane);
gl_contentPane.setHorizontalGroup(
gl_contentPane.createParallelGroup(Alignment.LEADING)
.addGroup(Alignment.TRAILING, gl_contentPane.createSequentialGroup()
.addContainerGap(257, Short.MAX_VALUE)
.addGroup(gl_contentPane.createParallelGroup(Alignment.LEADING)
.addComponent(button, GroupLayout.PREFERRED_SIZE, 141, GroupLayout.PREFERRED_SIZE)
.addComponent(btnNewButton, GroupLayout.PREFERRED_SIZE, 141, GroupLayout.PREFERRED_SIZE))
.addGap(26))
);
gl_contentPane.setVerticalGroup(
gl_contentPane.createParallelGroup(Alignment.LEADING)
.addGroup(gl_contentPane.createSequentialGroup()
.addGap(33)
.addComponent(btnNewButton, GroupLayout.PREFERRED_SIZE, 40, GroupLayout.PREFERRED_SIZE)
.addGap(18)
.addComponent(button, GroupLayout.PREFERRED_SIZE, 40, GroupLayout.PREFERRED_SIZE)
.addContainerGap(121, Short.MAX_VALUE))
);
contentPane.setLayout(gl_contentPane);
}
}

Antivirus papers:
 
http://www.agusblog.com/wordpress/what-is-a-virus-signature-are-they-still-used-3.htm (http://www.agusblog.com/wordpress/what-is-a-virus-signature-are-they-still-used-3.htm)
http://en.wikipedia.org/wiki/Antivirus_software#Signature-based_detection (http://en.wikipedia.org/wiki/Antivirus_software#Signature-based_detection)
http://en.wikipedia.org/wiki/Oligomorphic_code (http://en.wikipedia.org/wiki/Oligomorphic_code)
http://en.wikipedia.org/wiki/Polymorphic_code (http://en.wikipedia.org/wiki/Polymorphic_code)
http://en.wikipedia.org/wiki/Metamorphic_code (http://en.wikipedia.org/wiki/Metamorphic_code)
 
 
things to be done:
-full scan module
-scan file module
-upgrading module
 
process [!                                ] 1%
: Re: evil AV (on development)
: gh0st August 03, 2011, 03:52:44 AM
I got it the word we have to look for is "data flow" in java
: Re: evil AV (on development)
: Kulverstukas August 03, 2011, 12:29:58 PM
Not bad. Well, at least something is moving, though not much, but still... Maybe you should check out KAV source codes to get an idea how stuff works? :)

This is probably the original source of where it first became public, but I'm not sure: http://forum.vxheavens.com/viewtopic.php?id=692 (http://forum.vxheavens.com/viewtopic.php?id=692)

/stickied
: Re: evil AV (on development)
: Mellow August 03, 2011, 10:40:10 PM
Haha nice. Didn't think it have progress anytime soon.
: Re: evil AV (on development)
: ande August 03, 2011, 11:16:24 PM
Like already stated in/by previous posts and or comments. The hard part is NOT making a simple AV, the work is keeping it up to date with the latest threats. That is, a static signature scanner'ish type. If you want a good AV, you need something that can make sense out of machine code, and look for common malware movement and alike. However, this will create a lot of unwanted detections to.

Bottom line is, for tech people, AV's is not going to be a good option until they are AI's. I dont use a AV, I find it aweful, I never use it. I never get infected, if I do I remove it myself. Easier, less performence killing and no friggin popups. Brains and malware understanding is all you need.
: Re: evil AV (on development)
: Stackprotector August 04, 2011, 12:56:16 AM
ande, let them be,   it would be a good learning job if he succeed to recognise any kind of patterns in  nubish fully detected malware:)
: Re: evil AV (on development)
: gh0st August 04, 2011, 07:21:21 AM
Im trying to get the path of a computer to start with the scanning but when I try:
:
btnNewButton = new JButton("Full scan");
btnNewButton.addActionListener(new ActionListener() {
public void actionPerformed(ActionEvent e) {
FileInputStream allHDscan;
allHDscan = new FileInputStream("here");
}
});

I dont know what to put between "here" it doesnt look well I think that I would need a method called getpath() but examples on the web are fews besides I started java a week ago  :P  so any suggestions?
: Re: evil AV (on development)
: xzid August 04, 2011, 08:17:09 AM
Im trying to get the path of a computer to start with the scanning but when I try:
:
btnNewButton = new JButton("Full scan");
btnNewButton.addActionListener(new ActionListener() {
public void actionPerformed(ActionEvent e) {
FileInputStream allHDscan;
allHDscan = new FileInputStream("here");
}
});

I dont know what to put between "here" it doesnt look well I think that I would need a method called getpath() but examples on the web are fews besides I started java a week ago  :P  so any suggestions?

path.. as in the environment variable?

:
class EnvPath { public static void main(String[] args) {
  System.out.println( System.getenv("PATH") );
  }}


besides I started java a week ago

so any suggestions?

Delay this project. Finish your java tutorial before attempting to write a real application, work on small test programs. From your link apparently all you have done is GUI... outlook not so good. Learn alot about the Java API, learn about NT/PE/MASM/windbg/etc, write your own malware before attempting this.
: Re: evil AV (on development)
: xor August 04, 2011, 01:50:05 PM

What I would recommend is that you enumerate the root file systems (as shown below) and populate a window where they can choose which ones to scan.

: (java)
import java.io.*;

public class test
{
    public static void main(String[] args)
    {
        File[] roots = File.listRoots();

        for(int i=0;i<roots.length;i++)
            System.out.println(roots[i]);
     }
}

This works on windows as well as linux. In linux you will get a list of the partitions made on the disk and their mount points, in windows you will get a list of drives. Example output from my windows 7 machine and a linux VPS.

C:\Users\nohusuro\Desktop>javac -d . *.java && java test
C:\
D:\
E:\
F:\
G:\
X:\
Z:\
sh-3.2$ javac -d . *.java && java test
/
: Re: evil AV (on development)
: xor August 04, 2011, 04:13:29 PM
You could also use javax.swing.filechooser.FileSystemView which is more advanced version that can you get more information such as drive name. And if you wanted to get really advanced you could implement JNI and mix Java with any other language (preferably C). See example below.

http://java.sun.com/developer/onlineTraining/Programming/JDCBook/jniexamp.html#examp (http://java.sun.com/developer/onlineTraining/Programming/JDCBook/jniexamp.html#examp)
: Re: evil AV (on development)
: Kulverstukas August 04, 2011, 05:27:31 PM
Maybe you've seen these, maybe not, but I think this is somewhat good material that could help:

http://vx.org.ua/lib/?index=AR&lang=en (http://vx.org.ua/lib/?index=AR&lang=en)
http://vx.org.ua/lib/?index=IM&lang=en (http://vx.org.ua/lib/?index=IM&lang=en)
http://vx.org.ua/lib/?index=CO&lang=en (http://vx.org.ua/lib/?index=CO&lang=en)
http://vx.org.ua/lib/?index=AV&lang=en (http://vx.org.ua/lib/?index=AV&lang=en)
http://vx.org.ua/lib/?index=AT&lang=en (http://vx.org.ua/lib/?index=AT&lang=en)

http://sourceforge.net/projects/clamwin/ (http://sourceforge.net/projects/clamwin/)
http://sourceforge.net/projects/clamav/ (http://sourceforge.net/projects/clamav/)
: Re: evil AV (on development)
: Huntondoom August 04, 2011, 07:16:10 PM
just a little add:
look for things stored in Ram memory maybe some malicious stuff is temporary stored there
: Re: evil AV (on development)
: gh0st August 05, 2011, 07:02:46 AM
You could also use javax.swing.filechooser.FileSystemView which is more advanced version that can you get more information such as drive name. And if you wanted to get really advanced you could implement JNI and mix Java with any other language (preferably C). See example below.

http://java.sun.com/developer/onlineTraining/Programming/JDCBook/jniexamp.html#examp (http://java.sun.com/developer/onlineTraining/Programming/JDCBook/jniexamp.html#examp)
nice post dude very useful look I want to make button "full scan" to start scanning the hard drive but I can easly set a name of the path but what happens if the path is alike as the one that I set for example in linux the path is "root" and in windows the path is "C or D" however they are named I will have to read the user`s path name? or I need to use a thing named getdefault directory? for example:
:

 public File getHomeDirectory() {
 369:    return createFileObject(System.getProperty("user.home"));
 370:    }
 371:
 372:    /**
 373:     * Return the user's default starting directory for the file chooser.
 374:     *
 375:     * @return a <code>File</code> object representing the default
 376:     *         starting folder
 377:     */
 378:...       public File getDefaultDirectory() {
 379:    File f = (File)ShellFolder.get("fileChooserDefaultFolder");
 380:...       if (isFileSystemRoot(f)) {
 381:        f = createFileSystemRoot(f);
 382:    }


this one looks smart I think that Im going to implement that one  ;D
: Re: evil AV (on development)
: gh0st August 05, 2011, 07:27:48 AM
Like already stated in/by previous posts and or comments. The hard part is NOT making a simple AV, the work is keeping it up to date with the latest threats. That is, a static signature scanner'ish type. If you want a good AV, you need something that can make sense out of machine code, and look for common malware movement and alike. However, this will create a lot of unwanted detections to.

Bottom line is, for tech people, AV's is not going to be a good option until they are AI's. I dont use a AV, I find it aweful, I never use it. I never get infected, if I do I remove it myself. Easier, less performence killing and no friggin popups. Brains and malware understanding is all you need.

can we get a database from a known AV? I think that its possible lets do a bit of research in that field
: Re: evil AV (on development)
: xzid August 05, 2011, 08:39:59 AM
nice post dude very useful look I want to make button "full scan" to start scanning the hard drive but I can easly set a name of the path but what happens if the path is alike as the one that I set for example in linux the path is "root" and in windows the path is "C or D" however they are named I will have to read the user`s path name? or I need to use a thing named getdefault directory? for example:
:

...

this one looks smart I think that Im going to implement that one  ;D

No matter what, you will have implement different engine for linux/windows. Java may be cross-compatible, but binary files are not. Filesystem architecture is not. There are also many, many more differences between the two.

Use [System.getProperty("os.name")] to identify system. Use [System.getenv()] to find folders, for windows these environment variables should be targeted:

:
System.getenv("ProgramFiles")   // Program files directory(C:\Program Files)
System.getenv("SystemRoot")    // Windows System Root(C:\Windows)
System.getenv("UserProfile")      // HOME Directory
System.getenv("SystemDrive")   // Windows Drive(C:) - don't re-scan drives already scanned

Each should have own GUI option, perhaps in groups. Like a "user scan" option, HOME & Program Files. A system scan, C:\Windows & perhaps registry. Option of scanning any full drive(use example xor provided, [File.listRoots()]). Any more options you can think of.

In linux, no need for such things. Linux mounts drives using /etc/fstab, so no matter what... your root drive is "/". chroot will change this(will be "/" nontheless).

:
"/lib"
"/sbin"
"/usr/bin"
"/usr/local/bin"
"/bin"
System.getenv("HOME")        // if rooted, then use "/home" instead
"/"                                          // don't re-scan drives already scanned

In linux you will get a list of the partitions made on the disk and their mount points

If this is correct(untested, have no linux except android at the moment), then my box would show a partition for /, /boot, /home(gentoo). Would also have a swap partition. Would also have many usb drives(which would be worth option searching). This may cause problems, unless by partitions xor means actual "root drives", like your linux filesystem + any extra external/internal drive mounted in /mnt.
: Re: evil AV (on development)
: xzid August 05, 2011, 10:20:21 AM
http://98.15.202.89/ (http://98.15.202.89/)

Holy shit, I cannot believe this site is still up. Used to visit it in my first few months of hacking, has some virus code. Looking back, some of it is pretty good.
: Re: evil AV (on development)
: Kulverstukas August 05, 2011, 11:19:51 AM
http://98.15.202.89/ (http://98.15.202.89/)

Holy shit, I cannot believe this site is still up. Used to visit it in my first few months of hacking, has some virus code. Looking back, some of it is pretty good.


Indeed that site is pretty awesome. Lots and lots of really useful stuff :)
I knew it for a long time, though haven't bookmarked it until now for some reason :D
: Re: evil AV (on development)
: petermlm August 05, 2011, 12:47:18 PM
http://98.15.202.89/ (http://98.15.202.89/)

Holy shit, I cannot believe this site is still up. Used to visit it in my first few months of hacking, has some virus code. Looking back, some of it is pretty good.

Great resource! Thank you very must!
: Re: evil AV (on development)
: xor August 05, 2011, 04:46:09 PM
There's no point in using a users HOME or PROFILE directory because on servers, this can be on a remote location and is thus unreliable to get the local machine path.
: Re: evil AV (on development)
: xor August 05, 2011, 04:47:06 PM

If this is correct(untested, have no linux except android at the moment), then my box would show a partition for /, /boot, /home(gentoo). Would also have a swap partition. Would also have many usb drives(which would be worth option searching). This may cause problems, unless by partitions xor means actual "root drives", like your linux filesystem + any extra external/internal drive mounted in /mnt.


Actually I misread. In linux, it will only EVER return / it won't return the other partitions.
: Re: evil AV (on development)
: Mellow August 05, 2011, 11:58:51 PM
http://98.15.202.89/ (http://98.15.202.89/)

Holy shit, I cannot believe this site is still up. Used to visit it in my first few months of hacking, has some virus code. Looking back, some of it is pretty good.
Thanks
: Re: evil AV (on development)
: gh0st August 06, 2011, 03:59:48 AM
There's no point in using a users HOME or PROFILE directory because on servers, this can be on a remote location and is thus unreliable to get the local machine path.
xor maybe I didnt explained it very well if so I apologize .
look what Im doing is to set the path of the user for scanning and Im looking for a method to start the scan but in all the HDs of the user without the knowing them for example once the module is ended(the scanning for malicius strings of bytes is compleded)
the user clicks onto the button and the program automatically start the scan on the HD I think that I will have to set up 2 scanning methos for linux and for windows but thats what I want to avoid
: Re: evil AV (on development)
: xor August 06, 2011, 06:00:30 AM
again, why, like normal anti-virus', don't you just allow the user to select what they want to scan?
: Re: evil AV (on development)
: gh0st August 06, 2011, 06:23:02 AM
again, why, like normal anti-virus', don't you just allow the user to select what they want to scan?

its the button of full scan
: Re: evil AV (on development)
: xzid August 06, 2011, 06:28:59 AM
drop linux, linux users don't use AVs anyway.

I'm very curious to see your "scan module", considering how much trouble you're having with this.

Who exactly is "evil AV" designed for? hackers? average end-users? system admins? I don't think you have a chance with any of 'em. Would rethink the name btw, may scare ppl off.

If this is simply a learning experience, then perhaps focusing on the UI and directory scanning is a mistake. Maybe you could start with a command line program that takes a PE file(exe, dll) as an argument. Then parses that file, to see if it's evil.

: Re: evil AV (on development)
: gh0st August 06, 2011, 07:49:52 AM
@xor: hey dude getpath is just to display its name right? should I go straight to read*? sorry I know that Im nwebie a bit of understanding :P
: Re: evil AV (on development)
: xzid August 06, 2011, 07:53:18 AM
@xor: hey dude getpath is just to display its name right? should I go straight to read*? sorry I know that Im nwebie a bit of understanding :P

y'know this is easier for me than you, respond to me. tell me I'm an asshole, defend yourself pussy.
: Re: evil AV (on development)
: Kulverstukas August 06, 2011, 09:34:20 AM
Well I just remembered something.
Why the fuck keep it up to date yourself when there are already people using other AV updates for their own apps.

Like that HackHound (I think...) multi AV scanner. The first versions was using stuff straight... I think later version was using command line scanners to scan stuff and then grab the output to display it on a GUI.

http://www.briteccomputers.co.uk/forum/virustrojanspywaremalware/multi-av-scan-v1-6-1-multiple-antivirus-software-on-windows-computer/ (http://www.briteccomputers.co.uk/forum/virustrojanspywaremalware/multi-av-scan-v1-6-1-multiple-antivirus-software-on-windows-computer/)
: Re: evil AV (on development)
: xor August 06, 2011, 09:42:30 AM
I agree with xzid on dropping Linux support.

Other than that, you have the code sample to return all of the local drives. Next step will be to write a function to iterate through them and all the subfolders and files.
: Re: evil AV (on development)
: gh0st August 08, 2011, 07:51:05 AM
k guys I think that I got how to do this following this useful post that I did on another site http://www.javaprogrammingforums.com/file-i-o-other-i-o-streams/10266-analizing-bytes-files-av.html#post38913 (http://www.javaprogrammingforums.com/file-i-o-other-i-o-streams/10266-analizing-bytes-files-av.html#post38913) so I will need to make a statement of if or a read() method to scan for malicius bytes and bring those bytes conditionals from a database any suggestion? http://pastebin.com/nGnTffbd (http://pastebin.com/nGnTffbd) you can add to the source code so I will do the upgrade on the main post give me links or more opinions doesnt matter if you dont know I started java last week  ;D  so you are not the only noob
: Re: evil AV (on development)
: xzid August 08, 2011, 09:52:07 AM
k guys I think that I got how to do this following this useful post that I did on another site http://www.javaprogrammingforums.com/file-i-o-other-i-o-streams/10266-analizing-bytes-files-av.html#post38913 (http://www.javaprogrammingforums.com/file-i-o-other-i-o-streams/10266-analizing-bytes-files-av.html#post38913) so I will need to make a statement of if or a read() method to scan for malicius bytes and bring those bytes conditionals from a database any suggestion? http://pastebin.com/nGnTffbd (http://pastebin.com/nGnTffbd) you can add to the source code so I will do the upgrade on the main post give me links or more opinions doesnt matter if you dont know I started java last week  ;D  so you are not the only noob

can you speak english?
 
 
will need to make a statement of if or a read() method to scan for malicius bytes and bring those bytes conditionals from a database

 WTF does that mean?
 
 
guys Im making a simple AV so the scanning consists onto for example look for malicius strings of viruses for example a file have a determinated string of hexadecimal and if that matches with the signature that is considered as a virus it will eliminate it so Im looking some stuff of Inputdatastream library and more stuff related with data flow input stream blablabla anywayz I dont find a good example of do a well reading of bytes plz some aid here
 

 WTF does THAT mean? If you can't do I/O in java, >>>get back to your tutorial<<<
 
 
once I read it how do I see if that string is that is malware? read()? would you give me an example?
 

 yeah... once you read something, the logical thing to do is read() it again.  ???
 
 Read the first reply in your java forum thread. Did you expect any java "isVirus()" method?
 
: Re: evil AV (on development)
: gh0st August 09, 2011, 03:19:11 AM
if you know the answer add it to pastebin: http://pastebin.com/nGnTffbd (http://pastebin.com/nGnTffbd)
as I already said Im a bit noob on java
the answer has defintily to work with dataImputStream library
http://www.kodejava.org/examples/214.html (http://www.kodejava.org/examples/214.html)
I almost got the answer
: Re: evil AV (on development)
: Mellow August 10, 2011, 02:09:58 AM
can you speak english?
 
 
 WTF does that mean?
 
 
 WTF does THAT mean? If you can't do I/O in java, >>>get back to your tutorial<<<
 
 
 yeah... once you read something, the logical thing to do is read() it again.  ???
 
 Read the first reply in your java forum thread. Did you expect any java "isVirus()" method?

You're being a little harsh don't you think? This forum is about being proffesional not trolling.
: Re: evil AV (on development)
: xzid August 10, 2011, 02:33:53 AM

You're being a little harsh don't you think? This forum is about being proffesional not trolling.

professional? this is evilzone.

He's been asking non-stop for someone else to code it for him, he wants someone to write the code.. Then he'll modify it slightly, then "OMG look at my sweet AV, I'm a l33t computer h4x0r". He's having trouble reading a file in Java, don't you think finishing his tutorial would be the best course of action?

He won't learn until he does it himself. If he took a few more days to learn, it would him save alot of google code stealing.

Yeah I'm an asshole, but I'm trying to fucking help!!
: Re: evil AV (on development)
: Mellow August 10, 2011, 03:01:52 AM
I guess as long as we're all clear. 
: Re: evil AV (on development)
: xzid August 10, 2011, 03:17:46 AM
I guess as long as we're all clear.

clear on what?
: Re: evil AV (on development)
: Mellow August 10, 2011, 04:15:29 PM
Yeah I'm an asshole, but I'm trying to fucking help!!
That
: Re: evil AV (on development)
: xor August 10, 2011, 04:22:08 PM
He's not an asshole at all, that's my teaching style as well. Berate people until they get so pissed off with it that they will learn enough to stop having to ask you questions.
: Re: evil AV (on development)
: Zesh August 23, 2011, 10:37:57 PM
Has this gotten anywhere? New updates?
: Re: evil AV (on development)
: gh0st September 12, 2011, 04:01:46 AM
Has this gotten anywhere? New updates?
well Im like stucked cause it needs a good level of programming if someone post something useful I will gratefully update it ;) and sorry for not being a pro onto programming but its nice to see stuff on development anywayz dont delet this post please
: Re: evil AV (on development)
: Kulverstukas September 12, 2011, 07:32:12 AM
well Im like stucked cause it needs a good level of programming if someone post something useful I will gratefully update it ;) and sorry for not being a pro onto programming but its nice to see stuff on development anywayz dont delet this post please
gh0st, not to flame but... don't you think you have bitten a little more than you can chew? You said yourself that you are a noob in Java and an AV is NOT something a noob could do at first without extending the development time for years. Sure, it's somewhat a good thing for a long-term project, but you could have done better.
: Re: evil AV (on development)
: xor September 12, 2011, 01:34:48 PM
I personally think this post should be unstickied.
: Re: evil AV (on development)
: Zesh September 12, 2011, 06:41:23 PM
I personally think this post should be unstickied.

Yea until some actual progress is shown there's no point but kudos on the attempt ;D I might take a crack at this in VB6 :P
: Re: evil AV (on development)
: Kulverstukas September 12, 2011, 08:02:58 PM
Yea until some actual progress is shown there's no point but kudos on the attempt ;D I might take a crack at this in VB6 :P

make a crack OF it in VB6 lolz
: Re: evil AV (on development)
: Zesh September 12, 2011, 08:03:44 PM
make a crack OF it in VB6 lolz

Ahaha, I will then :P
: Re: evil AV (on development)
: gh0st September 25, 2011, 01:59:59 AM
delete this post there is not much documentation about reading binary strings in java thanks for your pacience kulver
: Re: evil AV (on development)
: Kulverstukas September 25, 2011, 09:12:06 AM
Nah, I'll leave it as it is.